Firefox can use keyword searches for this without the need for an extension. Then you search by typing the keyword followed by the splunk search string: ... View more

I wrote a script to cleanup the xml I've been using. It's not tested very well but has saved me a bit of time https://github.com/BasiliusCarver/splunkformatdedup ... View more

I've also seen it happen when setting formatting in the "stats" tab of a normal search. ... View more

I have the same thing on SplunkCloud 7.2.9 this is how I can trigger it in chrome and safari (both without extensions enabled) Starting with this dashboard xml: <dashboard> <label>testing_bloated_xml</label> <row> <panel> <table> <search> <query>| makeresults 1 | eval thing1 = 1 | eval thing2 = 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> I just have to format the two columns quickly and then I end up with duplicated format tags for field "thing1". This gets a lot worse with more columns as it exponentially blows out the dashboard xml until the dashboard starts lagging heavily. Then I have to edit the xml to remove the duplicates which is pretty painful. ... View more